@corsenai/corsen-context 1.2.0

package/dist/index.mjs

@@ -0,0 +1,1792 @@
+// src/config.ts
+import { z } from "zod";
+var corsenContextConfigSchema = z.object({
+  siteUrl: z.string().url(),
+  siteName: z.string().optional(),
+  description: z.string().optional(),
+  content: z.object({
+    postTypes: z.array(z.string()).default(["post", "page"]),
+    excludePaths: z.array(z.string()).default([]),
+    maxPages: z.number().int().positive().default(500)
+  }).default({}),
+  mcp: z.object({
+    enabled: z.boolean().default(true),
+    endpoint: z.string().default("/v1/mcp"),
+    tools: z.array(z.string()).default(["search_site", "get_page_content", "list_content", "get_sitemap"])
+  }).default({}),
+  static: z.object({
+    generateLlmsTxt: z.boolean().default(true),
+    includeFullContent: z.boolean().default(true)
+  }).default({}),
+  security: z.object({
+    rateLimit: z.number().int().positive().default(100),
+    burstLimit: z.number().int().positive().default(10),
+    allowedOrigins: z.array(z.string()).default([]),
+    apiKey: z.string().optional(),
+    // Only honor forwarding headers (X-Forwarded-For, X-Real-IP, CF-Connecting-IP)
+    // when the request reaches the server through a trusted reverse proxy.
+    // Left false, the rate limiter keys on the socket address so spoofed
+    // forwarding headers cannot each land in a fresh bucket.
+    trustProxy: z.boolean().default(false),
+    // Advertise the exact server version via the X-Powered-By header and
+    // serverInfo. Disable to avoid version fingerprinting on public endpoints.
+    exposeVersion: z.boolean().default(true)
+  }).default({}),
+  cache: z.object({
+    enabled: z.boolean().default(true),
+    ttl: z.number().int().positive().default(3600),
+    driver: z.enum(["memory", "redis"]).default("memory")
+  }).default({}),
+  credit: z.boolean().default(true)
+});
+function resolveConfig(input) {
+  const config = corsenContextConfigSchema.parse(input);
+  if (!config.security.apiKey && process.env.CORSEN_CONTEXT_API_KEY) {
+    config.security.apiKey = process.env.CORSEN_CONTEXT_API_KEY;
+  }
+  if (config.cache.driver === "redis" && !process.env.REDIS_URL) {
+    const isProduction = process.env.NODE_ENV === "production";
+    if (isProduction) {
+      throw new Error(
+        'Corsen Context: cache.driver is "redis" but REDIS_URL environment variable is not set. Set REDIS_URL or switch to driver: "memory".'
+      );
+    } else {
+      console.warn(
+        '[corsen-context] WARNING: cache.driver is "redis" but REDIS_URL is not set. Falling back to memory cache. Set REDIS_URL for production.'
+      );
+    }
+  }
+  return config;
+}
+
+// src/mcp-server.ts
+import { createHash as createHash2 } from "crypto";
+import { z as z3 } from "zod";
+
+// src/types.ts
+var CREDIT_LINE = "Powered by Corsen Context \u2022 Built by Corsen AI \u2022 github.com/CorsenAI/corsen-context";
+var JSONRPC_ERRORS = {
+  PARSE_ERROR: { code: -32700, message: "Parse error" },
+  INVALID_REQUEST: { code: -32600, message: "Invalid Request" },
+  METHOD_NOT_FOUND: { code: -32601, message: "Method not found" },
+  INVALID_PARAMS: { code: -32602, message: "Invalid params" },
+  INTERNAL_ERROR: { code: -32603, message: "Internal error" },
+  // Server-defined error (JSON-RPC reserves -32000..-32099 for implementations).
+  // Used for auth failures and rate limiting across all adapters.
+  UNAUTHORIZED: { code: -32e3, message: "Unauthorized" },
+  RATE_LIMITED: { code: -32e3, message: "Rate limit exceeded" },
+  RESOURCE_NOT_FOUND: { code: -32002, message: "Resource not found" }
+};
+var SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "X-Frame-Options": "DENY",
+  "X-XSS-Protection": "0",
+  "Referrer-Policy": "strict-origin-when-cross-origin",
+  "Content-Security-Policy": "default-src 'none'",
+  "Cache-Control": "no-store",
+  "X-Powered-By": "Corsen Context / Corsen AI"
+};
+
+// src/version.ts
+var CORSEN_CONTEXT_VERSION = "1.2.0";
+var MCP_PROTOCOL_VERSION = "2025-11-25";
+
+// src/security.ts
+import { timingSafeEqual, createHash, createHmac, randomBytes } from "crypto";
+import dns from "dns/promises";
+import { z as z2 } from "zod";
+function isPrivateIp(ip) {
+  if (ip.startsWith("10.") || ip.startsWith("127.") || ip.startsWith("169.254.") || ip.startsWith("0.") || ip === "0.0.0.0") {
+    return true;
+  }
+  const parts = ip.split(".").map(Number);
+  if (parts.length === 4 && parts.every((p) => !isNaN(p) && p >= 0 && p <= 255)) {
+    if (parts[0] === 172 && parts[1] >= 16 && parts[1] <= 31) return true;
+    if (parts[0] === 192 && parts[1] === 168) return true;
+    if (parts[0] === 100 && parts[1] >= 64 && parts[1] <= 127) return true;
+    if (parts[0] === 198 && (parts[1] === 18 || parts[1] === 19)) return true;
+  }
+  const lower = ip.toLowerCase();
+  if (lower === "::1" || lower === "::") {
+    return true;
+  }
+  if (lower.startsWith("fc") || lower.startsWith("fd")) {
+    return true;
+  }
+  const firstHextet = lower.split(":")[0];
+  if (/^fe[89ab][0-9a-f]?$/.test(firstHextet)) {
+    return true;
+  }
+  const embeddedIpv4 = lower.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+  if (embeddedIpv4 && lower.includes(":")) {
+    return isPrivateIp(embeddedIpv4[1]);
+  }
+  const mappedHex = lower.match(/::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+  if (mappedHex) {
+    const hi = parseInt(mappedHex[1], 16);
+    const lo = parseInt(mappedHex[2], 16);
+    const dotted = `${hi >> 8 & 255}.${hi & 255}.${lo >> 8 & 255}.${lo & 255}`;
+    return isPrivateIp(dotted);
+  }
+  return false;
+}
+async function isPrivateUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (hostname === "localhost" || isPrivateIp(hostname)) {
+      return true;
+    }
+    try {
+      const results = await dns.lookup(hostname, { all: true });
+      for (const { address } of results) {
+        if (isPrivateIp(address)) {
+          return true;
+        }
+      }
+    } catch {
+      return true;
+    }
+    return false;
+  } catch {
+    return true;
+  }
+}
+var undiciAgentFactory;
+async function getUndiciAgentFactory() {
+  if (undiciAgentFactory !== void 0) return undiciAgentFactory;
+  try {
+    const undiciModule = "undici";
+    const undici = await import(undiciModule);
+    undiciAgentFactory = (ip, family) => new undici.Agent({
+      connect: {
+        // Force every connection for this request to the vetted IP.
+        lookup(_hostname, opts, cb) {
+          if (opts && opts.all) cb(null, [{ address: ip, family }]);
+          else cb(null, ip, family);
+        }
+      }
+    });
+  } catch {
+    undiciAgentFactory = null;
+  }
+  return undiciAgentFactory;
+}
+async function safeFetch(url, options) {
+  const parsed = new URL(url);
+  const hostname = parsed.hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    throw new Error("SSRF protection: only http(s) URLs are allowed");
+  }
+  if (hostname === "localhost" || isPrivateIp(hostname)) {
+    throw new Error("SSRF protection: cannot fetch private/internal URLs");
+  }
+  let resolvedIp;
+  try {
+    const results = await dns.lookup(hostname, { all: true });
+    for (const { address } of results) {
+      if (isPrivateIp(address)) {
+        throw new Error("SSRF protection: DNS resolved to private IP");
+      }
+    }
+    resolvedIp = results[0].address;
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("SSRF")) throw err;
+    throw new Error("SSRF protection: DNS resolution failed (fail-closed)");
+  }
+  const family = resolvedIp.includes(":") ? 6 : 4;
+  const agentFactory = await getUndiciAgentFactory();
+  const dispatcher = agentFactory ? agentFactory(resolvedIp, family) : void 0;
+  return fetch(url, {
+    ...options,
+    ...dispatcher ? { dispatcher } : {},
+    signal: options?.signal ?? AbortSignal.timeout(options?.timeout ?? 1e4),
+    redirect: "error"
+  });
+}
+var MemoryRateLimitStore = class {
+  store = /* @__PURE__ */ new Map();
+  maxKeys;
+  cleanupTimer = null;
+  constructor(options) {
+    this.maxKeys = options?.maxKeys ?? 1e5;
+    if (options?.autoCleanup !== false) {
+      this.cleanupTimer = setInterval(() => this.cleanup(), 6e4);
+      if (this.cleanupTimer && typeof this.cleanupTimer === "object" && "unref" in this.cleanupTimer) {
+        this.cleanupTimer.unref();
+      }
+    }
+  }
+  /** Number of tracked keys. */
+  get size() {
+    return this.store.size;
+  }
+  /** Stop the cleanup timer (for graceful shutdown or tests). */
+  destroy() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+  }
+  /** Evict the oldest-inserted keys until under the cap (after a prune pass). */
+  enforceCap() {
+    if (this.store.size < this.maxKeys) return;
+    this.cleanup();
+    while (this.store.size >= this.maxKeys) {
+      const oldest = this.store.keys().next().value;
+      if (oldest === void 0) break;
+      this.store.delete(oldest);
+    }
+  }
+  async getTimestamps(key, windowStart) {
+    const entry = this.store.get(key);
+    if (!entry) return [];
+    entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+    if (entry.timestamps.length === 0) {
+      this.store.delete(key);
+      return [];
+    }
+    return entry.timestamps;
+  }
+  async addTimestamp(key, timestamp) {
+    let entry = this.store.get(key);
+    if (!entry) {
+      this.enforceCap();
+      entry = { timestamps: [] };
+      this.store.set(key, entry);
+    }
+    entry.timestamps.push(timestamp);
+  }
+  /**
+   * Atomic prune + record + count. Runs synchronously (no await between the
+   * prune and the append), so concurrent requests on the same tick cannot
+   * interleave a check between another request's read and write — the TOCTOU
+   * race the split getTimestamps()/addTimestamp() path has.
+   */
+  async hit(key, windowStart, burstWindowStart, now) {
+    let entry = this.store.get(key);
+    if (!entry) {
+      this.enforceCap();
+      entry = { timestamps: [] };
+      this.store.set(key, entry);
+    }
+    entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+    entry.timestamps.push(now);
+    const windowCount = entry.timestamps.length;
+    const burstCount = entry.timestamps.filter((t) => t > burstWindowStart).length;
+    return { windowCount, burstCount };
+  }
+  async cleanup() {
+    const now = Date.now();
+    const windowStart = now - 6e4;
+    for (const [key, entry] of this.store) {
+      entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+      if (entry.timestamps.length === 0) {
+        this.store.delete(key);
+      }
+    }
+  }
+};
+var RateLimiter = class {
+  store;
+  windowMs;
+  maxRequests;
+  burstLimit;
+  constructor(maxRequestsPerMinute = 100, burstPerSecond = 10, store) {
+    this.windowMs = 6e4;
+    this.maxRequests = maxRequestsPerMinute;
+    this.burstLimit = burstPerSecond;
+    this.store = store || new MemoryRateLimitStore();
+  }
+  async check(key) {
+    const now = Date.now();
+    const windowStart = now - this.windowMs;
+    const burstWindowStart = now - 1e3;
+    if (this.store.hit) {
+      const { windowCount, burstCount: burstCount2 } = await this.store.hit(
+        key,
+        windowStart,
+        burstWindowStart,
+        now
+      );
+      if (burstCount2 > this.burstLimit) {
+        return { allowed: false, remaining: 0, resetAt: burstWindowStart + 1e3, retryAfter: 1 };
+      }
+      if (windowCount > this.maxRequests) {
+        return {
+          allowed: false,
+          remaining: 0,
+          resetAt: now + this.windowMs,
+          retryAfter: Math.max(1, Math.ceil(this.windowMs / 1e3))
+        };
+      }
+      return {
+        allowed: true,
+        remaining: Math.max(0, this.maxRequests - windowCount),
+        resetAt: now + this.windowMs
+      };
+    }
+    const timestamps = await this.store.getTimestamps(key, windowStart);
+    const burstCount = timestamps.filter((t) => t > burstWindowStart).length;
+    if (burstCount >= this.burstLimit) {
+      return {
+        allowed: false,
+        remaining: 0,
+        resetAt: burstWindowStart + 1e3,
+        retryAfter: 1
+      };
+    }
+    if (timestamps.length >= this.maxRequests) {
+      const oldestInWindow = timestamps[0];
+      const retryAfter = Math.ceil((oldestInWindow + this.windowMs - now) / 1e3);
+      return {
+        allowed: false,
+        remaining: 0,
+        resetAt: oldestInWindow + this.windowMs,
+        retryAfter: Math.max(1, retryAfter)
+      };
+    }
+    await this.store.addTimestamp(key, now);
+    return {
+      allowed: true,
+      remaining: this.maxRequests - timestamps.length - 1,
+      resetAt: now + this.windowMs
+    };
+  }
+};
+function extractClientIp(headers, socketIp, trustProxy = false) {
+  if (trustProxy) {
+    const cfIp = headers["cf-connecting-ip"];
+    if (typeof cfIp === "string" && cfIp) return cfIp.trim();
+    const realIp = headers["x-real-ip"];
+    if (typeof realIp === "string" && realIp) return realIp.trim();
+    const xff = headers["x-forwarded-for"];
+    if (typeof xff === "string" && xff) {
+      const first = xff.split(",")[0]?.trim();
+      if (first) return first;
+    }
+  }
+  return socketIp || "unknown";
+}
+var RATE_LIMIT_KEY_LABEL = "corsen-context:ratelimit-bucket";
+function buildRateLimitKey(clientIp, apiKey) {
+  if (apiKey) {
+    return `key:${createHmac("sha256", RATE_LIMIT_KEY_LABEL).update(apiKey).digest("hex").slice(0, 16)}`;
+  }
+  return `ip:${clientIp}`;
+}
+var jsonRpcRequestSchema = z2.object({
+  jsonrpc: z2.literal("2.0"),
+  method: z2.string().min(1).max(100),
+  params: z2.record(z2.unknown()).optional(),
+  id: z2.union([z2.string(), z2.number(), z2.null()]).optional()
+});
+var searchParamsSchema = z2.object({
+  query: z2.string().min(1).max(500),
+  limit: z2.number().int().min(1).max(50).default(10)
+});
+var getPageParamsSchema = z2.object({
+  uri: z2.string().min(1).max(2e3)
+});
+var listContentParamsSchema = z2.object({
+  type: z2.string().min(1).max(50).default("page"),
+  page: z2.number().int().min(1).default(1),
+  limit: z2.number().int().min(1).max(100).default(20)
+});
+function validateJsonRpcRequest(body) {
+  return jsonRpcRequestSchema.parse(body);
+}
+function validateOrigin(origin, allowed) {
+  if (allowed.length === 0) return true;
+  if (!origin) return false;
+  return allowed.includes(origin);
+}
+function validateHost(hostHeader, expectedHost) {
+  if (!hostHeader) return false;
+  const expected = new URL(expectedHost).host;
+  return hostHeader === expected;
+}
+function hashApiKey(key, salt) {
+  const keySalt = salt || randomBytes(16).toString("hex");
+  const hash = createHash("sha256").update(keySalt + key).digest("hex");
+  return { hash, salt: keySalt };
+}
+function validateApiKey(provided, expected) {
+  if (!expected) return true;
+  if (!provided) return false;
+  const compareKey = randomBytes(32);
+  const a = createHmac("sha256", compareKey).update(provided).digest();
+  const b = createHmac("sha256", compareKey).update(expected).digest();
+  return timingSafeEqual(a, b);
+}
+var ApiKeyManager = class {
+  keys = /* @__PURE__ */ new Map();
+  /**
+   * Register a new API key. Returns the plain key (show to user once).
+   */
+  generateKey(options) {
+    const plainKey = `csk_${randomBytes(32).toString("base64url")}`;
+    const { hash, salt } = hashApiKey(plainKey);
+    const record = {
+      id: randomBytes(8).toString("hex"),
+      name: options.name,
+      keyHash: hash,
+      keySalt: salt,
+      scopes: options.scopes || ["*"],
+      quotaPerDay: options.quotaPerDay || 0,
+      // 0 = unlimited
+      requestsToday: 0,
+      quotaResetAt: this.nextMidnight(),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastUsedAt: null,
+      expiresAt: options.expiresAt?.toISOString() || null,
+      revoked: false
+    };
+    this.keys.set(record.id, record);
+    return { plainKey, record };
+  }
+  /**
+   * Validate a provided API key against stored records.
+   * Returns the matching record or null.
+   */
+  validate(providedKey, requiredScope) {
+    for (const record of this.keys.values()) {
+      if (record.revoked) continue;
+      if (record.expiresAt && new Date(record.expiresAt) < /* @__PURE__ */ new Date()) continue;
+      const { hash } = hashApiKey(providedKey, record.keySalt);
+      if (!timingSafeEqual(Buffer.from(hash), Buffer.from(record.keyHash))) continue;
+      if (requiredScope && !record.scopes.includes("*") && !record.scopes.includes(requiredScope)) {
+        continue;
+      }
+      if (record.quotaPerDay > 0) {
+        if (/* @__PURE__ */ new Date() > new Date(record.quotaResetAt)) {
+          record.requestsToday = 0;
+          record.quotaResetAt = this.nextMidnight();
+        }
+        if (record.requestsToday >= record.quotaPerDay) {
+          continue;
+        }
+        record.requestsToday++;
+      }
+      record.lastUsedAt = (/* @__PURE__ */ new Date()).toISOString();
+      return record;
+    }
+    return null;
+  }
+  /**
+   * Revoke an API key by ID.
+   */
+  revoke(keyId) {
+    const record = this.keys.get(keyId);
+    if (!record) return false;
+    record.revoked = true;
+    return true;
+  }
+  /**
+   * List all keys (without secrets).
+   */
+  listKeys() {
+    return Array.from(this.keys.values()).map(({ keyHash, keySalt, ...rest }) => rest);
+  }
+  /**
+   * Load keys from external storage (e.g., Redis, database).
+   */
+  loadKeys(records) {
+    for (const record of records) {
+      this.keys.set(record.id, record);
+    }
+  }
+  nextMidnight() {
+    const tomorrow = /* @__PURE__ */ new Date();
+    tomorrow.setUTCHours(24, 0, 0, 0);
+    return tomorrow.toISOString();
+  }
+};
+
+// src/cache.ts
+var DEFAULT_MAX_ENTRIES = 1e3;
+var CLEANUP_INTERVAL_MS = 6e4;
+var MemoryCache = class {
+  store = /* @__PURE__ */ new Map();
+  maxEntries;
+  cleanupTimer = null;
+  constructor(options) {
+    this.maxEntries = options?.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    if (options?.autoCleanup !== false) {
+      this.cleanupTimer = setInterval(() => this.cleanup(), CLEANUP_INTERVAL_MS);
+      if (this.cleanupTimer && typeof this.cleanupTimer === "object" && "unref" in this.cleanupTimer) {
+        this.cleanupTimer.unref();
+      }
+    }
+  }
+  async get(key) {
+    const entry = this.store.get(key);
+    if (!entry) return null;
+    if (Date.now() > entry.expiresAt) {
+      this.store.delete(key);
+      return null;
+    }
+    entry.lastAccessedAt = Date.now();
+    return entry.value;
+  }
+  async set(key, value, ttl) {
+    if (!this.store.has(key) && this.store.size >= this.maxEntries) {
+      this.evictLRU();
+    }
+    this.store.set(key, {
+      value,
+      expiresAt: Date.now() + ttl * 1e3,
+      lastAccessedAt: Date.now()
+    });
+  }
+  async delete(key) {
+    this.store.delete(key);
+  }
+  async clear() {
+    this.store.clear();
+  }
+  /** Current number of entries */
+  get size() {
+    return this.store.size;
+  }
+  /** Stop automatic cleanup (for graceful shutdown or testing) */
+  destroy() {
+    if (this.cleanupTimer) {
+      clearInterval(this.cleanupTimer);
+      this.cleanupTimer = null;
+    }
+  }
+  /** Remove all expired entries */
+  cleanup() {
+    const now = Date.now();
+    for (const [key, entry] of this.store) {
+      if (now > entry.expiresAt) {
+        this.store.delete(key);
+      }
+    }
+  }
+  /** Evict the least-recently-accessed entry */
+  evictLRU() {
+    let oldestKey = null;
+    let oldestTime = Infinity;
+    for (const [key, entry] of this.store) {
+      if (entry.lastAccessedAt < oldestTime) {
+        oldestTime = entry.lastAccessedAt;
+        oldestKey = key;
+      }
+    }
+    if (oldestKey) {
+      this.store.delete(oldestKey);
+    }
+  }
+};
+
+// src/logger.ts
+import pino from "pino";
+function createLogger(options = {}) {
+  return pino({
+    name: options.name || "corsen-context",
+    level: options.level || process.env.LOG_LEVEL || "info",
+    ...options.pretty ? {
+      transport: {
+        target: "pino-pretty",
+        options: { colorize: true }
+      }
+    } : {},
+    formatters: {
+      level(label) {
+        return { level: label };
+      }
+    },
+    timestamp: pino.stdTimeFunctions.isoTime,
+    redact: {
+      paths: ["apiKey", "authorization", "password", "secret", "token"],
+      censor: "[REDACTED]"
+    }
+  });
+}
+var defaultLogger = null;
+function getLogger() {
+  if (!defaultLogger) {
+    defaultLogger = createLogger();
+  }
+  return defaultLogger;
+}
+function setLogger(logger) {
+  defaultLogger = logger;
+}
+function securityLogger(parent) {
+  const base = parent || getLogger();
+  return base.child({ module: "security" });
+}
+function mcpLogger(parent) {
+  const base = parent || getLogger();
+  return base.child({ module: "mcp" });
+}
+
+// src/content-policy.ts
+function siteOrigin(config) {
+  return new URL(config.siteUrl).origin;
+}
+function percentDecode(value) {
+  let current = value;
+  for (let i = 0; i < 3; i++) {
+    let decoded;
+    try {
+      decoded = decodeURIComponent(current);
+    } catch {
+      return current;
+    }
+    if (decoded === current) break;
+    current = decoded;
+  }
+  return current;
+}
+function normalizePath(path) {
+  const trimmed = percentDecode(path.trim());
+  if (!trimmed) return null;
+  const withSlash = `/${trimmed.replace(/^\/+/, "")}`;
+  const withoutTrailing = withSlash.replace(/\/+$/, "");
+  return withoutTrailing || "/";
+}
+function pathFromUrlOrPath(value, config) {
+  try {
+    const parsed = new URL(value, config.siteUrl);
+    return normalizePath(parsed.pathname);
+  } catch {
+    return normalizePath(value);
+  }
+}
+function isExcludedPath(pathname, config) {
+  const path = normalizePath(pathname);
+  if (!path) return false;
+  const lowerPath = path.toLowerCase();
+  return config.content.excludePaths.some((exclude) => {
+    const excluded = pathFromUrlOrPath(exclude, config);
+    if (!excluded || excluded === "/") return false;
+    const lowerExcluded = excluded.toLowerCase();
+    return lowerPath === lowerExcluded || lowerPath.startsWith(`${lowerExcluded}/`);
+  });
+}
+function resolvePublicPageUrl(input, config) {
+  const raw = input.trim();
+  if (!raw) return null;
+  const value = raw.startsWith("resource://") ? `/${raw.slice("resource://".length).replace(/^\/+/, "")}` : raw;
+  let parsed;
+  try {
+    parsed = new URL(value, config.siteUrl);
+  } catch {
+    return null;
+  }
+  if (!["http:", "https:"].includes(parsed.protocol)) {
+    return null;
+  }
+  if (parsed.origin !== siteOrigin(config)) {
+    return null;
+  }
+  if (isExcludedPath(parsed.pathname, config)) {
+    return null;
+  }
+  return parsed.toString();
+}
+function isPublicListItem(item, config) {
+  if (!config.content.postTypes.includes(item.type)) {
+    return false;
+  }
+  return resolvePublicPageUrl(item.url, config) !== null;
+}
+function filterPublicPages(pages, config) {
+  return pages.filter((page) => isPublicListItem(page, config)).slice(0, config.content.maxPages);
+}
+function isPublicPageContent(content, config) {
+  return resolvePublicPageUrl(content.url, config) !== null;
+}
+function filterPublicSearchResults(results, config, limit) {
+  return results.filter((result) => resolvePublicPageUrl(result.url, config) !== null).slice(0, limit);
+}
+
+// src/mcp-server.ts
+var API_VERSION = "v1";
+var MAX_BODY_SIZE = 100 * 1024;
+var MAX_JSON_DEPTH = 10;
+var REQUEST_TIMEOUT_MS = 8e3;
+function validateBodySize(body) {
+  const serialized = JSON.stringify(body);
+  if (serialized.length > MAX_BODY_SIZE) {
+    throw new Error("Request body too large");
+  }
+}
+function checkJsonDepth(obj, currentDepth = 0) {
+  if (currentDepth > MAX_JSON_DEPTH) {
+    throw new Error("JSON nesting too deep");
+  }
+  if (obj && typeof obj === "object") {
+    for (const value of Object.values(obj)) {
+      checkJsonDepth(value, currentDepth + 1);
+    }
+  }
+}
+var MCPServer = class _MCPServer {
+  config;
+  provider;
+  rateLimiter;
+  cache;
+  log;
+  constructor(config, provider, options) {
+    this.config = config;
+    this.provider = provider;
+    this.rateLimiter = new RateLimiter(
+      config.security.rateLimit,
+      config.security.burstLimit,
+      options?.rateLimitStore
+    );
+    this.cache = options?.cache || new MemoryCache();
+    this.log = (options?.logger || getLogger()).child({ module: "mcp" });
+  }
+  getSecurityHeaders() {
+    return { ...SECURITY_HEADERS };
+  }
+  getCorsHeaders(origin) {
+    const headers = {};
+    if (this.config.security.allowedOrigins.length === 0) {
+      headers["Access-Control-Allow-Origin"] = "*";
+      headers["Access-Control-Allow-Methods"] = "POST, OPTIONS";
+      headers["Access-Control-Allow-Headers"] = "Content-Type, Authorization, X-MCP-Key";
+      headers["Access-Control-Max-Age"] = "86400";
+    } else if (origin && validateOrigin(origin, this.config.security.allowedOrigins)) {
+      headers["Access-Control-Allow-Origin"] = origin;
+      headers["Access-Control-Allow-Methods"] = "POST, OPTIONS";
+      headers["Access-Control-Allow-Headers"] = "Content-Type, Authorization, X-MCP-Key";
+      headers["Access-Control-Max-Age"] = "86400";
+      headers["Vary"] = "Origin";
+    }
+    return headers;
+  }
+  async checkRateLimit(clientIp, apiKey) {
+    const key = buildRateLimitKey(clientIp, apiKey);
+    const result = await this.rateLimiter.check(key);
+    const headers = {
+      "X-RateLimit-Limit": String(this.config.security.rateLimit),
+      "X-RateLimit-Remaining": String(result.remaining),
+      "X-RateLimit-Reset": String(Math.ceil(result.resetAt / 1e3))
+    };
+    if (!result.allowed) {
+      const ipHash = createHash2("sha256").update(clientIp).digest("hex").slice(0, 12);
+      this.log.warn({ key: key.replace(/:.+/, ":***"), ipHash }, "rate_limit_exceeded");
+      if (result.retryAfter) {
+        headers["Retry-After"] = String(result.retryAfter);
+      }
+    }
+    return { allowed: result.allowed, headers };
+  }
+  checkAuth(apiKeyHeader) {
+    const valid = validateApiKey(apiKeyHeader, this.config.security.apiKey);
+    if (!valid && this.config.security.apiKey) {
+      this.log.warn({ provided: !!apiKeyHeader }, "auth_failed");
+    }
+    return valid;
+  }
+  async handleRequest(body, clientIp, apiKey, options) {
+    const start = Date.now();
+    let requestId = null;
+    let method = "unknown";
+    try {
+      validateBodySize(body);
+      checkJsonDepth(body);
+      const request = validateJsonRpcRequest(body);
+      requestId = request.id ?? null;
+      method = request.method;
+      if (clientIp && !options?.skipRateLimit) {
+        const limit = await this.checkRateLimit(clientIp, apiKey);
+        if (!limit.allowed) {
+          return this.errorResponse(requestId, -32e3, "Rate limit exceeded");
+        }
+      }
+      if (!this.checkAuth(apiKey)) {
+        return this.errorResponse(requestId, JSONRPC_ERRORS.UNAUTHORIZED.code, "Unauthorized");
+      }
+      const isNotification = !("id" in body);
+      if (isNotification) {
+        await this.dispatch(request);
+        this.log.debug({ method, type: "notification", durationMs: Date.now() - start }, "request_handled");
+        return null;
+      }
+      const result = await this.dispatch(request);
+      const duration = Date.now() - start;
+      this.log.info({ method, id: requestId, durationMs: duration, status: "ok" }, "request_handled");
+      return result;
+    } catch (err) {
+      const duration = Date.now() - start;
+      if (err instanceof z3.ZodError) {
+        this.log.warn({ method, durationMs: duration, error: "invalid_request" }, "request_failed");
+        return this.errorResponse(requestId, JSONRPC_ERRORS.INVALID_REQUEST.code, "Invalid JSON-RPC request");
+      }
+      if (err instanceof Error && (err.message === "Request body too large" || err.message === "JSON nesting too deep")) {
+        this.log.warn({ method, durationMs: duration, error: err.message }, "dos_rejected");
+        return this.errorResponse(requestId, JSONRPC_ERRORS.INVALID_REQUEST.code, err.message);
+      }
+      this.log.error({ method, durationMs: duration, error: err instanceof Error ? err.message : "unknown" }, "request_error");
+      return this.errorResponse(requestId, JSONRPC_ERRORS.INTERNAL_ERROR.code, "Internal error");
+    }
+  }
+  async dispatch(request) {
+    const { method, params, id } = request;
+    switch (method) {
+      case "initialize":
+        return this.handleInitialize(params, id);
+      case "notifications/initialized":
+        return this.successResponse(id ?? null, {});
+      case "ping":
+        return this.successResponse(id ?? null, {});
+      case "tools/list":
+        return this.handleListTools(id);
+      case "tools/call":
+        return this.handleCallTool(params, id);
+      case "resources/list":
+        return this.handleListResources(params, id);
+      case "resources/read":
+        return this.handleReadResource(params, id);
+      default:
+        return this.errorResponse(
+          id ?? null,
+          JSONRPC_ERRORS.METHOD_NOT_FOUND.code,
+          `Method not found: ${method}`
+        );
+    }
+  }
+  handleInitialize(params, id) {
+    this.log.info("mcp_initialized");
+    const requested = typeof params?.protocolVersion === "string" ? params.protocolVersion : null;
+    const protocolVersion = requested === MCP_PROTOCOL_VERSION ? requested : MCP_PROTOCOL_VERSION;
+    return this.successResponse(id ?? null, {
+      protocolVersion,
+      capabilities: {
+        tools: {},
+        resources: {}
+      },
+      serverInfo: {
+        name: "corsen-context",
+        // Omit the exact version when fingerprinting is disabled.
+        ...this.config.security.exposeVersion ? { version: CORSEN_CONTEXT_VERSION } : {}
+      }
+    });
+  }
+  handleListTools(id) {
+    return this.successResponse(id ?? null, {
+      tools: this.getToolDefinitions()
+    });
+  }
+  async handleCallTool(params, id) {
+    if (!params || typeof params.name !== "string") {
+      return this.errorResponse(id ?? null, JSONRPC_ERRORS.INVALID_PARAMS.code, "Missing tool name");
+    }
+    const toolName = params.name;
+    const toolArgs = params.arguments || {};
+    if (!this.config.mcp.tools.includes(toolName)) {
+      return this.errorResponse(
+        id ?? null,
+        JSONRPC_ERRORS.METHOD_NOT_FOUND.code,
+        `Tool not found: ${toolName}`
+      );
+    }
+    try {
+      const toolStart = Date.now();
+      let result;
+      switch (toolName) {
+        case "search_site": {
+          const parsed = searchParamsSchema.parse(toolArgs);
+          result = await this.searchSite(parsed.query, parsed.limit);
+          break;
+        }
+        case "get_page_content": {
+          const parsed = getPageParamsSchema.parse(toolArgs);
+          result = await this.getPageContent(parsed.uri);
+          if (!result) {
+            return this.errorResponse(id ?? null, -32002, "Resource not found");
+          }
+          break;
+        }
+        case "list_content": {
+          const parsed = listContentParamsSchema.parse(toolArgs);
+          result = await this.listContent(parsed.type, parsed.page, parsed.limit);
+          break;
+        }
+        case "get_sitemap": {
+          result = await this.getSitemap();
+          break;
+        }
+        default:
+          return this.errorResponse(id ?? null, JSONRPC_ERRORS.METHOD_NOT_FOUND.code, `Unknown tool: ${toolName}`);
+      }
+      this.log.debug({ tool: toolName, durationMs: Date.now() - toolStart }, "tool_called");
+      return this.successResponse(id ?? null, {
+        content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+      });
+    } catch (err) {
+      if (err instanceof z3.ZodError) {
+        return this.errorResponse(id ?? null, JSONRPC_ERRORS.INVALID_PARAMS.code, "Invalid tool parameters");
+      }
+      this.log.error({ tool: toolName, error: err instanceof Error ? err.message : "unknown" }, "tool_error");
+      return this.errorResponse(id ?? null, JSONRPC_ERRORS.INTERNAL_ERROR.code, "Tool execution failed");
+    }
+  }
+  /** Page size for resources/list cursor pagination. */
+  static RESOURCES_PAGE_SIZE = 100;
+  async handleListResources(params, id) {
+    const pages = filterPublicPages(await this.provider.getPages(), this.config);
+    const all = pages.flatMap((p) => {
+      let parsed;
+      try {
+        parsed = new URL(p.url, this.config.siteUrl);
+      } catch {
+        return [];
+      }
+      const pathWithQuery = parsed.pathname + parsed.search;
+      return [
+        {
+          uri: `resource://${pathWithQuery.replace(/^\//, "")}`,
+          name: p.title,
+          description: p.description,
+          mimeType: "text/markdown"
+        }
+      ];
+    });
+    const pageSize = _MCPServer.RESOURCES_PAGE_SIZE;
+    const offset = this.decodeCursor(params?.cursor);
+    const slice = all.slice(offset, offset + pageSize);
+    const nextOffset = offset + pageSize;
+    const result = { resources: slice };
+    if (nextOffset < all.length) {
+      result.nextCursor = Buffer.from(String(nextOffset)).toString("base64");
+    }
+    return this.successResponse(id ?? null, result);
+  }
+  decodeCursor(cursor) {
+    if (typeof cursor !== "string" || !cursor) return 0;
+    const decoded = Number.parseInt(Buffer.from(cursor, "base64").toString("utf8"), 10);
+    return Number.isInteger(decoded) && decoded >= 0 ? decoded : 0;
+  }
+  async handleReadResource(params, id) {
+    if (!params || typeof params.uri !== "string") {
+      return this.errorResponse(id ?? null, JSONRPC_ERRORS.INVALID_PARAMS.code, "Missing resource URI");
+    }
+    const uri = params.uri;
+    const pageUrl = resolvePublicPageUrl(uri, this.config);
+    if (!pageUrl) {
+      return this.errorResponse(id ?? null, -32002, "Resource not found");
+    }
+    const content = await this.provider.getPageContent(pageUrl);
+    if (!content || !isPublicPageContent(content, this.config)) {
+      return this.errorResponse(id ?? null, -32002, "Resource not found");
+    }
+    return this.successResponse(id ?? null, {
+      contents: [
+        {
+          uri,
+          mimeType: "text/markdown",
+          text: content.markdown
+        }
+      ]
+    });
+  }
+  // --- Tool Implementations ---
+  get cacheEnabled() {
+    return this.config.cache.enabled;
+  }
+  async cacheGet(key) {
+    if (!this.cacheEnabled) return null;
+    return this.cache.get(key);
+  }
+  async cacheSet(key, value) {
+    if (!this.cacheEnabled) return;
+    await this.cache.set(key, value, this.config.cache.ttl);
+  }
+  /**
+   * Drop the cached body for a single page URL. Call this from your CMS's
+   * publish/update/delete hooks so edits and unpublishes propagate before the
+   * TTL expires (otherwise stale content can be served for up to cache.ttl).
+   */
+  async invalidatePage(url) {
+    const pageUrl = resolvePublicPageUrl(url, this.config);
+    if (pageUrl) await this.cache.delete(`page:${pageUrl}`);
+  }
+  /**
+   * Clear all cached MCP responses (search, page, list, sitemap). Call after
+   * bulk content changes. No-op for cache drivers without prefix enumeration
+   * (see RedisCache.clear notes).
+   */
+  async clearCache() {
+    await this.cache.clear();
+  }
+  async searchSite(query, limit = 10) {
+    const cacheKey = `search:${query}:${limit}`;
+    const cached = await this.cacheGet(cacheKey);
+    if (cached !== null) return cached;
+    const results = filterPublicSearchResults(
+      await this.provider.searchContent(query, limit),
+      this.config,
+      limit
+    );
+    await this.cacheSet(cacheKey, results);
+    return results;
+  }
+  async getPageContent(uri) {
+    const pageUrl = resolvePublicPageUrl(uri, this.config);
+    if (!pageUrl) return null;
+    const cacheKey = `page:${pageUrl}`;
+    const cached = await this.cacheGet(cacheKey);
+    if (cached !== null) return cached;
+    const content = await this.provider.getPageContent(pageUrl);
+    if (content && isPublicPageContent(content, this.config)) {
+      await this.cacheSet(cacheKey, content);
+      return content;
+    }
+    return null;
+  }
+  async listContent(type, page = 1, limit = 20) {
+    const cacheKey = `list:${type}:${page}:${limit}`;
+    const cached = await this.cacheGet(cacheKey);
+    if (cached !== null) return cached;
+    const publicPages = (await this.provider.getPages()).filter(
+      (p) => isPublicListItem(p, this.config)
+    );
+    const filtered = publicPages.filter((p) => p.type === type);
+    const total = filtered.length;
+    const start = (page - 1) * limit;
+    const items = filtered.slice(start, start + limit);
+    const result = {
+      items,
+      total,
+      page,
+      limit,
+      hasMore: start + limit < total
+    };
+    await this.cacheSet(cacheKey, result);
+    return result;
+  }
+  async getSitemap() {
+    const cacheKey = "sitemap";
+    const cached = await this.cacheGet(cacheKey);
+    if (cached !== null) return cached;
+    const pages = filterPublicPages(await this.provider.getPages(), this.config);
+    const sitemap = pages.map((p) => ({
+      url: p.url,
+      title: p.title,
+      type: p.type,
+      lastModified: p.lastModified
+    }));
+    await this.cacheSet(cacheKey, sitemap);
+    return sitemap;
+  }
+  // --- Tool Definitions ---
+  getToolDefinitions() {
+    const tools = [];
+    if (this.config.mcp.tools.includes("search_site")) {
+      tools.push({
+        name: "search_site",
+        description: "Search site content by keyword. Returns matching pages with snippets.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            query: { type: "string", description: "Search query" },
+            limit: { type: "number", description: "Max results (1-50, default 10)" }
+          },
+          required: ["query"]
+        }
+      });
+    }
+    if (this.config.mcp.tools.includes("get_page_content")) {
+      tools.push({
+        name: "get_page_content",
+        description: "Get full page content as clean markdown with metadata (title, description, dates).",
+        inputSchema: {
+          type: "object",
+          properties: {
+            uri: { type: "string", description: "Page URL or resource URI" }
+          },
+          required: ["uri"]
+        }
+      });
+    }
+    if (this.config.mcp.tools.includes("list_content")) {
+      tools.push({
+        name: "list_content",
+        description: "List content by type (page, post, product) with pagination.",
+        inputSchema: {
+          type: "object",
+          properties: {
+            type: { type: "string", description: "Content type (e.g., post, page, product, or any custom type)" },
+            page: { type: "number", description: "Page number (default 1)" },
+            limit: { type: "number", description: "Items per page (1-100, default 20)" }
+          }
+        }
+      });
+    }
+    if (this.config.mcp.tools.includes("get_sitemap")) {
+      tools.push({
+        name: "get_sitemap",
+        description: "Get structured sitemap of the entire site with URLs, titles, types, and dates.",
+        inputSchema: {
+          type: "object",
+          properties: {}
+        }
+      });
+    }
+    return tools;
+  }
+  getCapabilities() {
+    return {
+      tools: this.getToolDefinitions(),
+      resources: []
+    };
+  }
+  // --- Response Helpers ---
+  successResponse(id, result) {
+    return { jsonrpc: "2.0", result, id };
+  }
+  errorResponse(id, code, message) {
+    return { jsonrpc: "2.0", error: { code, message }, id };
+  }
+};
+
+// src/llms-txt.ts
+async function generateLlmsTxt(config, provider) {
+  const pages = filterPublicPages(await provider.getPages(), config);
+  const siteUrl = config.siteUrl.replace(/\/$/, "");
+  const mcpEndpoint = config.mcp.enabled ? `${siteUrl}${config.mcp.endpoint}` : null;
+  const lines = [];
+  lines.push(`# ${config.siteName || new URL(config.siteUrl).hostname}`);
+  lines.push("");
+  if (config.description) {
+    lines.push(`> ${config.description}`);
+    lines.push("");
+  }
+  lines.push("## About this AI Context File");
+  lines.push(
+    "This file is optimized for AI agents and MCP clients (2025-11-25 spec)."
+  );
+  if (mcpEndpoint) {
+    lines.push(`For dynamic structured access use the MCP endpoint below.`);
+  }
+  lines.push("");
+  const grouped = groupByType(pages);
+  if (grouped.page && grouped.page.length > 0) {
+    lines.push("## Main Pages");
+    for (const p of grouped.page) {
+      const desc = p.description ? ` \u2013 ${p.description}` : "";
+      lines.push(`- [${p.title}](${p.url})${desc}`);
+    }
+    lines.push("");
+  }
+  if (grouped.post && grouped.post.length > 0) {
+    lines.push("## Blog & Content");
+    for (const p of grouped.post) {
+      const desc = p.description ? ` \u2013 ${p.description}` : "";
+      const date = p.lastModified ? ` \u2022 ${p.lastModified.split("T")[0]}` : "";
+      lines.push(`- [${p.title}](${p.url})${desc}${date}`);
+    }
+    lines.push("");
+  }
+  if (grouped.product && grouped.product.length > 0) {
+    lines.push("## Products / Services");
+    for (const p of grouped.product) {
+      const desc = p.description ? ` \u2013 ${p.description}` : "";
+      lines.push(`- [${p.title}](${p.url})${desc}`);
+    }
+    lines.push("");
+  }
+  for (const [type, items] of Object.entries(grouped)) {
+    if (["page", "post", "product"].includes(type)) continue;
+    if (items.length === 0) continue;
+    lines.push(`## ${capitalize(type)}`);
+    for (const p of items) {
+      const desc = p.description ? ` \u2013 ${p.description}` : "";
+      lines.push(`- [${p.title}](${p.url})${desc}`);
+    }
+    lines.push("");
+  }
+  if (config.credit) {
+    const mcpPart = mcpEndpoint ? ` \u2022 MCP endpoint: ${mcpEndpoint}` : "";
+    lines.push(`**${CREDIT_LINE}**${mcpPart}`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+async function generateLlmsFullTxt(config, provider) {
+  const pages = filterPublicPages(await provider.getPages(), config);
+  const sections = [];
+  sections.push(`# ${config.siteName || new URL(config.siteUrl).hostname} \u2014 Full Content`);
+  sections.push("");
+  sections.push(
+    "> This file contains the full markdown content of all pages for AI consumption."
+  );
+  sections.push("");
+  for (const page of pages) {
+    const pageUrl = resolvePublicPageUrl(page.url, config);
+    if (!pageUrl) continue;
+    const content = await provider.getPageContent(pageUrl);
+    if (!content || !isPublicPageContent(content, config)) continue;
+    sections.push("---");
+    sections.push("");
+    sections.push(`## ${content.title}`);
+    sections.push(`URL: ${content.url}`);
+    if (content.lastModified) {
+      sections.push(`Last modified: ${content.lastModified}`);
+    }
+    sections.push("");
+    sections.push(content.markdown);
+    sections.push("");
+  }
+  if (config.credit) {
+    sections.push("---");
+    sections.push("");
+    sections.push(`**${CREDIT_LINE}**`);
+    sections.push("");
+  }
+  return sections.join("\n");
+}
+function groupByType(pages) {
+  const grouped = {};
+  for (const page of pages) {
+    const type = page.type || "page";
+    if (!grouped[type]) grouped[type] = [];
+    grouped[type].push(page);
+  }
+  return grouped;
+}
+function capitalize(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
+}
+
+// src/sitemap.ts
+import { XMLParser } from "fast-xml-parser";
+var parser = new XMLParser({
+  ignoreAttributes: false,
+  attributeNamePrefix: "@_",
+  processEntities: false
+  // Defense in depth: block XXE even if lib defaults change
+});
+var MAX_SITEMAP_SIZE = 5 * 1024 * 1024;
+async function parseSitemap(sitemapUrl, maxPages = 500) {
+  if (await isPrivateUrl(sitemapUrl)) {
+    throw new Error("SSRF protection: cannot fetch private/internal URLs");
+  }
+  const entries = [];
+  const seen = /* @__PURE__ */ new Set();
+  await fetchAndParseSitemap(sitemapUrl, entries, seen, maxPages, 0);
+  return entries.slice(0, maxPages);
+}
+async function readBounded(response) {
+  const contentLength = response.headers?.get?.("content-length");
+  if (contentLength && parseInt(contentLength, 10) > MAX_SITEMAP_SIZE) {
+    return null;
+  }
+  const body = response.body;
+  if (!body || typeof body.getReader !== "function") {
+    const text = await response.text();
+    return text.length > MAX_SITEMAP_SIZE ? null : text;
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value) {
+        total += value.byteLength;
+        if (total > MAX_SITEMAP_SIZE) {
+          await reader.cancel();
+          return null;
+        }
+        chunks.push(value);
+      }
+    }
+  } catch {
+    return null;
+  }
+  return new TextDecoder().decode(concatChunks(chunks, total));
+}
+function concatChunks(chunks, total) {
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return out;
+}
+async function fetchAndParseSitemap(url, entries, seen, maxPages, depth) {
+  if (depth > 3 || entries.length >= maxPages) return;
+  let response;
+  try {
+    response = await safeFetch(url, {
+      headers: { "User-Agent": "CorsenContext/1.0 (+https://github.com/CorsenAI/corsen-context)" },
+      timeout: 1e4
+    });
+  } catch {
+    return;
+  }
+  if (!response.ok) return;
+  const xml = await readBounded(response);
+  if (xml === null) return;
+  const parsed = parser.parse(xml);
+  if (parsed.sitemapindex?.sitemap) {
+    const sitemaps = Array.isArray(parsed.sitemapindex.sitemap) ? parsed.sitemapindex.sitemap : [parsed.sitemapindex.sitemap];
+    for (const sm of sitemaps) {
+      if (entries.length >= maxPages) break;
+      if (sm.loc) {
+        await fetchAndParseSitemap(sm.loc, entries, seen, maxPages, depth + 1);
+      }
+    }
+    return;
+  }
+  if (parsed.urlset?.url) {
+    const urls = Array.isArray(parsed.urlset.url) ? parsed.urlset.url : [parsed.urlset.url];
+    for (const u of urls) {
+      if (entries.length >= maxPages) break;
+      if (!u.loc || seen.has(u.loc)) continue;
+      if (await isPrivateUrl(u.loc)) continue;
+      seen.add(u.loc);
+      const priority = typeof u.priority === "string" ? parseFloat(u.priority) : u.priority;
+      entries.push({
+        url: u.loc,
+        lastmod: u.lastmod,
+        changefreq: u.changefreq,
+        priority: typeof priority === "number" && Number.isFinite(priority) ? priority : void 0
+      });
+    }
+  }
+}
+async function discoverSitemap(siteUrl) {
+  const base = siteUrl.replace(/\/$/, "");
+  const candidates = [
+    `${base}/sitemap.xml`,
+    `${base}/sitemap_index.xml`,
+    `${base}/sitemap/sitemap.xml`
+  ];
+  try {
+    const robotsUrl = `${base}/robots.txt`;
+    const res = await safeFetch(robotsUrl, { timeout: 5e3 });
+    if (res.ok) {
+      const text = await res.text();
+      const match = text.match(/^Sitemap:\s*(.+)$/im);
+      if (match?.[1]) {
+        return match[1].trim();
+      }
+    }
+  } catch {
+  }
+  for (const url of candidates) {
+    try {
+      const res = await safeFetch(url, {
+        method: "HEAD",
+        timeout: 5e3
+      });
+      if (res.ok) return url;
+    } catch {
+      continue;
+    }
+  }
+  return null;
+}
+
+// src/converter.ts
+import * as cheerio from "cheerio";
+import TurndownService from "turndown";
+var turndown = new TurndownService({
+  headingStyle: "atx",
+  bulletListMarker: "-",
+  codeBlockStyle: "fenced",
+  emDelimiter: "*"
+});
+turndown.remove(["script", "style", "nav", "iframe", "noscript", "svg"]);
+var DANGEROUS_URL_SCHEME = /^\s*(?:javascript|vbscript|file|data):/i;
+function sanitizeUrls(markdown) {
+  return markdown.replace(/(!?)\[([^\]]*)\]\(([^)]*)\)/g, (match, bang, label, url) => {
+    if (!DANGEROUS_URL_SCHEME.test(url)) return match;
+    return `[${label}](#)`;
+  });
+}
+turndown.addRule("pre", {
+  filter: "pre",
+  replacement(content, node) {
+    const el = node;
+    const code = el.textContent || content;
+    return `
+\`\`\`
+${code.trim()}
+\`\`\`
+`;
+  }
+});
+function htmlToMarkdown(html) {
+  const $ = cheerio.load(html);
+  $(
+    'nav, aside, body > header, body > footer, .sidebar, .menu, .navigation, .cookie-banner, .popup, .modal, #comments, .comments, .ad, .advertisement, [role="navigation"], [role="banner"], [role="complementary"]'
+  ).remove();
+  const mainSelectors = [
+    "main",
+    "article",
+    '[role="main"]',
+    ".entry-content",
+    ".post-content",
+    ".article-content",
+    ".page-content",
+    "#content",
+    ".content"
+  ];
+  let contentHtml = "";
+  for (const sel of mainSelectors) {
+    const el = $(sel).first();
+    if (el.length && el.text().trim()) {
+      contentHtml = el.html() || "";
+      if (contentHtml) break;
+    }
+  }
+  if (!contentHtml) {
+    contentHtml = $("body").html() || html;
+  }
+  const markdown = turndown.turndown(contentHtml);
+  return sanitizeUrls(
+    markdown.replace(/\n{3,}/g, "\n\n").replace(/^\s+|\s+$/g, "").trim()
+  );
+}
+function extractMetadata(html) {
+  const $ = cheerio.load(html);
+  const meta = {};
+  const title = $("title").first().text().trim();
+  if (title) meta["title"] = title;
+  const desc = $('meta[name="description"]').attr("content") || $('meta[property="og:description"]').attr("content");
+  if (desc) meta["description"] = desc.trim();
+  const ogTitle = $('meta[property="og:title"]').attr("content");
+  if (ogTitle) meta["og:title"] = ogTitle.trim();
+  const ogImage = $('meta[property="og:image"]').attr("content");
+  if (ogImage) meta["og:image"] = ogImage.trim();
+  const ogType = $('meta[property="og:type"]').attr("content");
+  if (ogType) meta["og:type"] = ogType.trim();
+  const canonical = $('link[rel="canonical"]').attr("href");
+  if (canonical) meta["canonical"] = canonical.trim();
+  const author = $('meta[name="author"]').attr("content");
+  if (author) meta["author"] = author.trim();
+  const published = $('meta[property="article:published_time"]').attr("content") || $("time[datetime]").first().attr("datetime");
+  if (published) meta["published"] = published.trim();
+  const modified = $('meta[property="article:modified_time"]').attr("content");
+  if (modified) meta["modified"] = modified.trim();
+  const lang = $("html").attr("lang");
+  if (lang) meta["lang"] = lang.trim();
+  return meta;
+}
+
+// src/redis-cache.ts
+var RedisCache = class {
+  redis;
+  prefix;
+  constructor(redis, options) {
+    this.redis = redis;
+    this.prefix = options?.prefix || "corsen:cache:";
+  }
+  async get(key) {
+    const raw = await this.redis.get(`${this.prefix}${key}`);
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      await this.delete(key);
+      return null;
+    }
+  }
+  async set(key, value, ttl) {
+    const serialized = JSON.stringify(value);
+    const redisKey = `${this.prefix}${key}`;
+    await this.redis.set(redisKey, serialized);
+    if (ttl > 0) {
+      await this.redis.expire(redisKey, ttl);
+    }
+  }
+  async delete(key) {
+    await this.redis.del(`${this.prefix}${key}`);
+  }
+  async clear() {
+    console.warn(
+      `[corsen-context] RedisCache.clear() is a no-op. Use SCAN + DEL with prefix "${this.prefix}" to clear cached entries manually.`
+    );
+  }
+};
+
+// src/redis-rate-limit.ts
+var RedisRateLimitStore = class {
+  redis;
+  prefix;
+  windowMs;
+  constructor(redis, options) {
+    this.redis = redis;
+    this.prefix = options?.prefix || "corsen:rl:";
+    this.windowMs = options?.windowMs || 6e4;
+  }
+  async getTimestamps(key, windowStart) {
+    const redisKey = `${this.prefix}${key}`;
+    await this.redis.zremrangebyscore(redisKey, "-inf", windowStart);
+    const members = await this.redis.zrangebyscore(redisKey, windowStart, "+inf");
+    return members.map((m) => {
+      const ts = parseFloat(m.split(":")[0]);
+      return isNaN(ts) ? 0 : ts;
+    }).filter((t) => t > 0);
+  }
+  async addTimestamp(key, timestamp) {
+    const redisKey = `${this.prefix}${key}`;
+    const member = `${timestamp}:${Math.random().toString(36).slice(2, 8)}`;
+    await this.redis.zadd(redisKey, timestamp, member);
+    const ttlSeconds = Math.ceil(this.windowMs / 1e3) + 1;
+    await this.redis.expire(redisKey, ttlSeconds);
+  }
+  /**
+   * Combined add-then-count. Records the hit first, prunes the window, then
+   * returns the window and burst counts (both including the current request).
+   * Fewer round-trips than getTimestamps()+addTimestamp() and add-first so a
+   * rejected request still counts against the window.
+   */
+  async hit(key, windowStart, burstWindowStart, now) {
+    const redisKey = `${this.prefix}${key}`;
+    const member = `${now}:${Math.random().toString(36).slice(2, 8)}`;
+    await this.redis.zadd(redisKey, now, member);
+    await this.redis.expire(redisKey, Math.ceil(this.windowMs / 1e3) + 1);
+    await this.redis.zremrangebyscore(redisKey, "-inf", windowStart);
+    const windowCount = await this.redis.zcard(redisKey);
+    const burstMembers = await this.redis.zrangebyscore(redisKey, burstWindowStart, "+inf");
+    return { windowCount, burstCount: burstMembers.length };
+  }
+  async cleanup() {
+  }
+};
+
+// src/providers.ts
+function makeSnippet(text, query) {
+  const haystack = text.toLowerCase();
+  const idx = haystack.indexOf(query.toLowerCase());
+  if (idx === -1) return text.slice(0, 200).trim();
+  const start = Math.max(0, idx - 80);
+  return text.slice(start, start + 200).trim();
+}
+function createInMemoryProvider(pages) {
+  const byUrl = new Map(pages.map((p) => [p.url, p]));
+  return {
+    async getPages() {
+      return pages.map((p) => ({
+        url: p.url,
+        title: p.title,
+        description: p.description,
+        type: p.type || "page",
+        lastModified: p.lastModified
+      }));
+    },
+    async getPageContent(url) {
+      return byUrl.get(url) ?? null;
+    },
+    async searchContent(query, limit) {
+      const q = query.toLowerCase();
+      const results = [];
+      for (const p of pages) {
+        const haystack = `${p.title}
+${p.description}
+${p.markdown}`.toLowerCase();
+        if (!haystack.includes(q)) continue;
+        results.push({
+          url: p.url,
+          title: p.title,
+          description: p.description,
+          snippet: makeSnippet(p.markdown || p.description || "", query),
+          score: 1
+        });
+        if (results.length >= limit) break;
+      }
+      return results;
+    }
+  };
+}
+function createSitemapProvider(siteUrl, options) {
+  const maxPages = options?.maxPages ?? 100;
+  let pagesCache = null;
+  async function loadPages() {
+    if (pagesCache) return pagesCache;
+    const sitemapUrl = await discoverSitemap(siteUrl);
+    if (!sitemapUrl) {
+      pagesCache = [];
+      return pagesCache;
+    }
+    const entries = await parseSitemap(sitemapUrl, maxPages);
+    const pages = [];
+    for (const entry of entries) {
+      try {
+        const res = await safeFetch(entry.url, { timeout: 1e4 });
+        if (!res.ok) continue;
+        const meta = extractMetadata(await res.text());
+        pages.push({
+          url: entry.url,
+          title: meta.title || entry.url,
+          description: meta.description || "",
+          type: meta["og:type"] === "article" ? "post" : "page",
+          lastModified: meta.modified || meta.published
+        });
+      } catch {
+        continue;
+      }
+    }
+    pagesCache = pages;
+    return pages;
+  }
+  return {
+    async getPages() {
+      return loadPages();
+    },
+    async getPageContent(url) {
+      if (await isPrivateUrl(url)) return null;
+      try {
+        const res = await safeFetch(url, { timeout: 1e4 });
+        if (!res.ok) return null;
+        const html = await res.text();
+        const meta = extractMetadata(html);
+        return {
+          url,
+          title: meta.title || url,
+          description: meta.description || "",
+          markdown: htmlToMarkdown(html),
+          lastModified: meta.modified || meta.published,
+          metadata: meta
+        };
+      } catch {
+        return null;
+      }
+    },
+    async searchContent() {
+      return [];
+    }
+  };
+}
+
+// src/discovery.ts
+function absoluteEndpoint(config) {
+  const base = config.siteUrl.replace(/\/$/, "");
+  const endpoint = config.mcpEndpoint || "/v1/mcp";
+  return /^https?:\/\//.test(endpoint) ? endpoint : `${base}${endpoint}`;
+}
+function generateRobotsTxt(config) {
+  const lines = [`MCP: ${absoluteEndpoint(config)}`];
+  if (config.sitemapUrl) lines.push(`Sitemap: ${config.sitemapUrl}`);
+  return lines.join("\n") + "\n";
+}
+function generateWellKnownMcp(config) {
+  return {
+    mcpEndpoint: absoluteEndpoint(config),
+    protocolVersion: MCP_PROTOCOL_VERSION,
+    transport: "http"
+  };
+}
+function mcpLinkTag(config) {
+  return `<link rel="mcp" href="${absoluteEndpoint(config)}" />`;
+}
+
+// src/index.ts
+var CorsenContext = class {
+  config;
+  provider;
+  cache;
+  rateLimitStore;
+  constructor(userConfig, provider, cache, rateLimitStore) {
+    this.config = resolveConfig(userConfig);
+    this.provider = provider;
+    this.cache = cache || new MemoryCache();
+    this.rateLimitStore = rateLimitStore || new MemoryRateLimitStore();
+  }
+  async generateLlmsTxt() {
+    return generateLlmsTxt(this.config, this.provider);
+  }
+  async generateLlmsFullTxt() {
+    return generateLlmsFullTxt(this.config, this.provider);
+  }
+  createMCPServer(options) {
+    return new MCPServer(this.config, this.provider, {
+      cache: this.cache,
+      rateLimitStore: options?.rateLimitStore ?? this.rateLimitStore,
+      logger: options?.logger
+    });
+  }
+  /** Drop the cached body for a single page URL (wire to CMS update/delete hooks). */
+  async invalidatePage(url) {
+    const pageUrl = resolvePublicPageUrl(url, this.config);
+    if (pageUrl) await this.cache.delete(`page:${pageUrl}`);
+  }
+  /** Clear all cached MCP responses. Call after bulk content changes. */
+  async clearCache() {
+    await this.cache.clear();
+  }
+  async discoverSitemap(url) {
+    return discoverSitemap(url || this.config.siteUrl);
+  }
+  async parseSitemap(sitemapUrl) {
+    return parseSitemap(sitemapUrl, this.config.content.maxPages);
+  }
+  convertToMarkdown(html) {
+    return htmlToMarkdown(html);
+  }
+  extractMetadata(html) {
+    return extractMetadata(html);
+  }
+  getConfig() {
+    return this.config;
+  }
+};
+export {
+  API_VERSION,
+  ApiKeyManager,
+  CORSEN_CONTEXT_VERSION,
+  CREDIT_LINE,
+  CorsenContext,
+  JSONRPC_ERRORS,
+  MAX_BODY_SIZE,
+  MAX_JSON_DEPTH,
+  MCPServer,
+  MCP_PROTOCOL_VERSION,
+  MemoryCache,
+  MemoryRateLimitStore,
+  REQUEST_TIMEOUT_MS,
+  RateLimiter,
+  RedisCache,
+  RedisRateLimitStore,
+  SECURITY_HEADERS,
+  buildRateLimitKey,
+  corsenContextConfigSchema,
+  createInMemoryProvider,
+  createLogger,
+  createSitemapProvider,
+  discoverSitemap,
+  extractClientIp,
+  extractMetadata,
+  filterPublicPages,
+  filterPublicSearchResults,
+  generateLlmsFullTxt,
+  generateLlmsTxt,
+  generateRobotsTxt,
+  generateWellKnownMcp,
+  getLogger,
+  getPageParamsSchema,
+  hashApiKey,
+  htmlToMarkdown,
+  isPrivateIp,
+  isPrivateUrl,
+  isPublicListItem,
+  isPublicPageContent,
+  listContentParamsSchema,
+  mcpLinkTag,
+  mcpLogger,
+  parseSitemap,
+  resolveConfig,
+  resolvePublicPageUrl,
+  safeFetch,
+  searchParamsSchema,
+  securityLogger,
+  setLogger,
+  validateApiKey,
+  validateHost,
+  validateOrigin
+};